专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

US20210011995A1 INSTALLING AND MANIPULATING A SECURE VIRTUAL MACHINE IMAGE THROUGH AN UNTRUSTED HYPERVISOR 有权
公开(公告)号：US20210011995A1
公开(公告)日：2021-01-14
申请号：US16937155
申请日：2020-07-23
申请人： Intel Corporation
发明人： David M. Durham , Karanvir S. Grewal , Sergej Deutsch , Michael Lemay
IPC分类号： G06F21/53 , G06F9/455 , G06F21/57 , H04L29/06
摘要： Systems, apparatuses and methods may provide for technology that associates a key domain of a plurality of key domains with a customer boot image, receives the customer boot image from the customer, and verifies the integrity of the customer boot image that is to be securely installed at memory locations determined from an untrusted privileged entity (e.g., a virtual machine manager).

2. 发明授权

US10802910B2 System for identifying and correcting data errors 有权
公开(公告)号：US10802910B2
公开(公告)日：2020-10-13
申请号：US16133574
申请日：2018-09-17
申请人： Intel Corporation
发明人： Sergej Deutsch , Wei Wu , David M. Durham , Karanvir S. Grewal
IPC分类号： G06F11/10 , G06F11/14 , G06F3/06 , G06F21/62
摘要： In one embodiment, an apparatus comprises a controller comprising circuitry, the controller to generate an error correction code for a memory line, the memory line comprising a plurality of first data blocks, wherein the error correction code comprises parity bits generated based on first portions of a plurality of second data blocks, wherein the plurality of second data blocks are the first data blocks or diffused data blocks generated from the plurality of first data blocks; generate a metadata block corresponding to the memory line, wherein the metadata block comprises the error correction code for the memory line and at least one metadata bit; encode the first data blocks and the metadata block; and provide the encoded data blocks and the encoded metadata block for storage on a memory module.

3. 发明授权

US10594491B2 Cryptographic system memory management 有权
公开(公告)号：US10594491B2
公开(公告)日：2020-03-17
申请号：US15816901
申请日：2017-11-17
申请人： INTEL CORPORATION
发明人： David M. Durham , Rajat Agarwal , Siddhartha Chhabra , Sergej Deutsch , Karanvir S. Grewal , Ioannis T. Schoinas
IPC分类号： H04L9/32 , G06F12/14 , G06F3/06 , G11C29/52 , H04L9/06 , G06F11/10 , G06F12/0886 , G06F21/79 , H04L9/08 , G06F21/78 , G11C29/44
摘要： In one example, a system for managing encrypted memory comprises a processor to store a first MAC based on data stored in system memory in response to a write operation to the system memory. The processor can also detect a read operation corresponding to the data stored in the system memory, calculate a second MAC based on the data retrieved from the system memory, determine that the second MAC does not match the first MAC, and recalculate the second MAC with a correction operation, wherein the correction operation comprises an XOR operation based on the data retrieved from the system memory and a replacement value for a device of the system memory. Furthermore, the processor can decrypt the data stored in the system memory in response to detecting the recalculated second MAC matches the first MAC and transmit the decrypted data to cache thereby correcting memory errors.

4. 发明申请

US20190044954A1 Methods And Apparatus To Support Reliable Digital Communications Without Integrity Metadata 审中-公开
公开(公告)号：US20190044954A1
公开(公告)日：2019-02-07
申请号：US15831633
申请日：2017-12-05
申请人： Intel Corporation
发明人： Michael Kounavis , Amitabh Das , Sergej Deutsch , Karanvir S. Grewal , David M. Durham
IPC分类号： H04L29/06 , H04L9/06
摘要： Before sending a message to a destination device, a source device automatically uses a pattern matching algorithm to analyze entropy characteristics of a plaintext version of the message. The pattern matching algorithm uses at least one pattern matching test to generate at least one entropy metric for the message. The source device automatically determines whether the message has sufficiently low entropy, based on results of the pattern matching algorithm. In response to a determination that the message does not have sufficiently low entropy, the source device automatically generates integrity metadata for the message and sends the integrity metadata to the destination device. However, in response to a determination that the message has sufficiently low entropy, the source device sends the message to the destination device without sending any integrity metadata for the message to the destination device. Other embodiments are described and claimed.

5. 发明申请

US20190036699A1 TECHNOLOGIES FOR END-TO-END BIOMETRIC-BASED AUTHENTICATION AND PLATFORM LOCALITY ASSERTION 审中-公开
公开(公告)号：US20190036699A1
公开(公告)日：2019-01-31
申请号：US16133952
申请日：2018-09-18
申请人： Intel Corporation
发明人： Ansuya Negi , Nitin V. Sarangdhar , Ulhas S. Warrier , Ramkumar Venkatachary , Ravi L. Sahita , Scott H. Robinson , Karanvir S. Grewal
IPC分类号： H04L9/32 , H04L9/08
CPC分类号： H04L9/3231 , H04L9/0816 , H04L9/0825
摘要： Technologies for end-to-end biometric-based authentication and locality assertion include a computing device with one or more biometric devices. The computing device may securely exchange a key between a driver and a secure enclave. The driver may receive biometric data from the biometric sensor in a virtualization-protected memory buffer and encrypt the biometric data with the shared key. The secure enclave may decrypt the biometric data and perform a biometric authentication operation. The computing device may measure a virtual machine monitor (VMM) to generate attestation information for the VMM. A secure enclave may execute a virtualization report instruction to request the attestation information. The processor may copy the attestation information into the secure enclave memory. The secure enclave may verify the attestation information with a remote attestation server. If verified, the secure enclave may provide a shared secret to the VMM. Other embodiments are described and claimed.

6. 发明授权

US09519803B2 Secure environment for graphics processing units 有权
标题翻译：图形处理单元的安全环境
公开(公告)号：US09519803B2
公开(公告)日：2016-12-13
申请号：US13690401
申请日：2012-11-30
申请人： Intel Corporation
发明人： Prashant Dewan , Uday R. Savagaonkar , David M. Durham , Paul S. Schmitz , Jason Martin , Michael Goldsmith , Ravi L. Sahita , Francis X. McKeen , Carlos Rozas , Balaji Vembu , Scott Janus , Geoffrey S. Strongin , Xiaozhu Kang , Karanvir S. Grewal , Siddhartha Chhabra , Alpha T. Narendra Trivedi
IPC分类号： G06F21/00 , G06F21/64 , G06F21/53 , G06F21/56
CPC分类号： G06F21/64 , G06F21/53 , G06F21/56
摘要： In accordance with some embodiments, a protected execution environment may be defined for a graphics processing unit. This framework not only protects the workloads from malware running on the graphics processing unit but also protects those workloads from malware running on the central processing unit. In addition, the trust framework may facilitate proof of secure execution by measuring the code and data structures used to execute the workload. If a part of the trusted computing base of this framework or protected execution environment is compromised, that part can be patched remotely and the patching can be proven remotely throughout attestation in some embodiments.
摘要翻译：根据一些实施例，可以为图形处理单元定义受保护的执行环境。该框架不仅保护了图形处理单元上运行的恶意软件的工作负载，还保护了这些工作负载免受中央处理单元上运行的恶意软件。此外，信任框架可以通过测量用于执行工作负载的代码和数据结构来促进安全执行的证明。如果该框架或受保护的执行环境的可信计算基础的一部分受到损害，那么该部分可以被远程修补，并且在一些实施例中可以通过验证远程验证修补。

7. 发明授权

US08903084B2 Efficient key derivation for end-to-end network security with traffic visibility 有权
标题翻译：针对具有流量可见性的端到端网络安全性的高效密钥导出
公开(公告)号：US08903084B2
公开(公告)日：2014-12-02
申请号：US13916027
申请日：2013-06-12
申请人： Intel Corporation
发明人： Men Long , Jesse Walker , Karanvir S. Grewal
IPC分类号： H04L9/00 , H04L9/08 , G06F7/04 , G06F21/00 , H04L29/06 , H04L9/06
CPC分类号： H04L9/0866 , H04L9/0631 , H04L63/0428 , H04L63/06 , H04L2209/125
摘要： Both end-to-end security and traffic visibility may be achieved by a system using a controller that derives a cryptographic key that is different for each client based on a derivation key and a client identifier that is conveyed in each data packet. The controller distributes the derivation key to information technology monitoring devices and a server to provide traffic visibility. For large key sizes, the key may be derived using a derivation formula as follows: client_key_MSB=AES128(base_key_1,client_ID), (1) client_key_LSB=AES128(base_key_2,client_ID+pad),and (2) client_key=client_key_MSB∥client_key_LSB, where (1) and (2) are executed in parallel. The client key and a client identifier may be used so that end-to-end security may be achieved.
摘要翻译：端到端安全性和流量可见性可以由使用控制器的系统来实现，所述控制器基于在每个数据分组中传送的导出密钥和客户端标识符来导出每个客户端不同的密码密钥。控制器将派生密钥分发到信息技术监控设备和服务器，以提供流量可视性。对于较大的密钥大小，可以使用如下的推导公式来导出密钥：client_key_MSB = AES128（base_key_1，client_ID），（1）client_key_LSB = AES128（base_key_2，client_ID + pad）和（2）client_key =client_key_MSB‖client_key_LSB，其中（1）和（2）并行执行。可以使用客户端密钥和客户端标识符，以便可以实现端到端的安全性。

8. 发明授权

US11580035B2 Fine-grained stack protection using cryptographic computing 有权
公开(公告)号：US11580035B2
公开(公告)日：2023-02-14
申请号：US17134406
申请日：2020-12-26
申请人： Intel Corporation
发明人： David M. Durham , Karanvir S. Grewal , Michael D. LeMay , Salmin Sultana , Andrew James Weiler
IPC分类号： G06F12/14 , G06F9/30 , G06F9/50
摘要： A processor includes a register to store an encoded pointer to a variable in stack memory. The encoded pointer includes an encrypted portion and a fixed plaintext portion of a memory address corresponding to the variable. The processor further includes circuitry to, in response to a memory access request for associated with the variable, decrypt the encrypted portion of the encoded pointer to obtain first upper address bits of the memory address and a memory allocation size for a variable, decode the encoded pointer to obtain the memory address, verify the memory address is valid based, at least in part on the memory allocation size, and in response to determining that the memory address is valid, allow the memory access request.

9. 发明申请

US20230027329A1 CRYPTOGRAPHIC COMPUTING IN MULTITENANT ENVIRONMENTS 有权
公开(公告)号：US20230027329A1
公开(公告)日：2023-01-26
申请号：US17791000
申请日：2020-12-26
申请人： Intel Corporation
发明人： David M. Durham , Michael D. LeMay , Salmin Sultana , Karanvir S. Grewal , Michael E. Kounavis , Sergej Deutsch , Andrew James Weiler , Abhishek Basak , Dan Baum , Santosh Ghosh
IPC分类号： G06F21/60 , G06F21/79 , G06F21/54
摘要： A processor, a system, a machine readable medium, and a method. The processor comprises first circuitry to: encrypt a first code image using a first code key; load the encrypted first code image into a memory area allocated in memory for the first code image by an operating system miming on the processor; and send to the operating system a substitute key that corresponds to the first code key, wherein the first code key is concealed from the operating system; and an instruction cache including control circuitry; and second circuitry coupled to the instruction cache, the second circuitry to: receive the substitute key from the operating system; in response to a first request from the operating system to execute the first code image to instantiate a first process, perform a first cryptographic function using a hardware key to generate the first code key from the substitute key; and program the control circuitry of the instruction cache with the first code key to enable the first code image to be decrypted using the first code key.

10. 发明申请

US20220335140A1 CRYPTOGRAPHIC COMPUTING ISOLATION FOR MULTI-TENANCY AND SECURE SOFTWARE COMPONENTS 有权
公开(公告)号：US20220335140A1
公开(公告)日：2022-10-20
申请号：US17854814
申请日：2022-06-30
申请人： Intel Corporation
发明人： Salmin Sultana , David M. Durham , Michael LeMay , Karanvir S. Grewal , Sergej Deutsch
IPC分类号： G06F21/60 , G06F21/31 , G06F21/80 , G06F9/30
摘要： Techniques for cryptographic computing isolation are described. A processor includes circuitry to be coupled to memory configured to store one or more instructions. The circuitry is to execute the one or more instructions to instantiate a first process based on an application. To instantiate the first process is to include creating a context table to be used by the first process, identifying a software component to be invoked during the first process, encrypting the software component using a first cryptographic key, and creating a first entry in the context table. The first entry is to include first context information identifying the encrypted software component and second context information representing the first cryptographic key. In more specific embodiments, third context information representing a first load address of the encrypted software component is stored in the first entry of the context table.

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式